SAP Global Physical Security 

Video Surveillance installations at the SAP premises in Philippines

 

Video surveillance cameras (also known as closed-circuit televisions, or CCTV) are directed at viewing and/or recording SAP premises which may include images of individuals to ensure an adequate level of security for and at a company´s premises in preventing and/or investigating break-ins, destruction, or other malicious activities.  

 

The video surveillance cameras are installed at:

• The various entry and exit points of the SAP offices; and

• Security relevant areas in the SAP buildings.

The premises of SAP Philippines, Inc., Concur Philippines, and SuccessFactors Philippines are in scope of this Privacy Statement.

 

Please see Annex 1 for the list of SAP premises in scope of this Privacy Statement.

 

All locations where your personal data may be captured are clearly marked by warning signs.

 

 

Who do We mean when We say SAP in this Privacy Statement?

 

The data controller for video surveillance is identified as the appropriate legal entity for respective SAP locations in the Philippines. A complete list of the relevant entities and their respective premises is available at Annex I (below) (“SAP”).

 

You can reach the data protection officers for SAP Philippines, Inc., Concur (Philippines) Inc., and SuccessFactors (Philippines), Inc. at dpo_sap.ph@sap.com, dpo_concur.ph@sap.com, dpo_successfactors.ph@sap.com, respectively.

 

 

What categories of Personal Data does SAP process?

 

If you move about or access SAP´s premises, we collect your images via video surveillance cameras, consisting of a recording of your activities excluding sound or voice (your "Personal Data").

 

 

 

For what purposes does SAP process your Personal Data?

 

SAP processes your Personal Data in order to ensure an adequate level of security for and at SAP´s premises.

 

This process allows SAP to provide you with access to SAP facilities and to ensure the security and safety of all SAP employees, suppliers, visitors, and assets across all global SAP locations. This allows SAP to comply with statutory obligations, including identification verification prior to or during access to any SAP-owned or leased facility.

 

Although providing personal data is voluntary, without your personal data, SAP cannot provide you with access to SAP-owned or leased facilities.

 

 

How long does SAP store your Personal Data?

 

SAP will store your Personal Data for a period of maximum 90 days. If the video surveillance recording is required for the investigation of an incident, it can be kept for as long as necessary to conclude the investigation.

 

SAP will also retain your Personal Data for additional periods if necessary for compliance with legal obligations to process your Personal Data or if the Personal Data is needed by SAP to assert or defend itself against legal claims. SAP will retain your Personal Data until the end of the relevant retention period or until the claims in question have been settled.

 

 

Who are the recipients of my Personal Data and where will it be processed?

 

Your Personal Data will be passed on to the following categories of third parties to process your Personal Data:

• companies within the SAP Group,
  

• third party service providers, including contracted security agencies that are contracted to provide security services at SAP, and

• legal or local law enforcement agencies, as the result of any corporate criminal or other security investigations.

These parties are located within and outside of the Philippines.

 

As part of a global group of companies operating internationally, SAP has affiliates (the “SAP Group”) and third-party service providers outside of the Philippines and may transfer your Personal Data to countries outside of the Philippines. SAP uses the EU standard contractual clauses to contractually require that your Personal Data receives a level of data protection consistent with the laws of the Philippines. You can obtain a copy (redacted to remove commercial or irrelevant) of such standard contractual clauses by sending a request to privacy@sap.com.

 

 

What are your data protection rights in relation to video surveillance?

 

Right to access and obtain a copy of Personal Data

You can request from SAP reasonable access to information about which Personal Data SAP processes about you and, if necessary, information about the ways in which such Personal Data has been or may have been used or disclosed by SAP. Please note, however, that SAP can or will delete your Personal Data only if there is no statutory obligation or prevailing right of SAP to retain it.

 

You can request for copies of your images or footages by providing sufficient details to identify the specific time and date of footage and to enable SAP to determine that the person making the request is the data subject of that specific recording.

 

Access granted to CCTV footage is tiered either by viewing or providing a copy, the latter option being allowed depending on the purpose of the request. SAP will act on viewing requests within five (5) working days from receipt of the request or of required additional supporting documents, while requests for copies of CCTV footage will be acted upon within fifteen (15) working days after receipt of the request or of required documentation.

 

Right to lodge a complaint

If you take the view that SAP is not processing your Personal Data in accordance with the requirements in this Privacy Statement or under applicable data protection laws, please contact the Data Protection Officers of the concerned entity by email. Otherwise, you may at any time lodge a complaint with the National Privacy Commission.

 

 

 

How can you exercise your data protection rights?

 

Please direct any requests to exercise your rights to SAP-Physical-Sec-Privacy@sap.com.

 

 

How will SAP verify requests to exercise data protection rights?

 

SAP will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise.  When feasible, SAP will match Personal Data provided by you in submitting a request to exercise your rights with information already maintained by SAP. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by SAP. 

 

SAP will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law.

 

 

Why does SAP need to use my Personal Data and on what legal basis is SAP using it?

 

SAP can use your Personal Data based on its legitimate interest (Article 12(f) and 13(f) of the Data Privacy Act of 2012) as follows:

• to control access to SAP´s premises;

• to ensure adequate security for and at SAP´s premises;

• to ensure the safety of SAP employees and visitors at SAP´s premises;

• to prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information;

• to prevent sabotage, theft and material damage.

You can at any time object to SAP’s use of your Personal Data as set forth in this section by sending an email to SAP-Physical-Sec-Privacy@sap.com. In this case, SAP will carefully review your objection and cease further use of the relevant information, subject to SAP’s compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP requires the information for the establishment, exercise or defense of legal claims. In addition, SAP can use your Personal Data based on a legal obligation to support the rightful and valid requests of public authorities for support in an investigation.

 

ANNEX I

 

SAP Philippines, Inc.

• MNL02, 27th Floor, NAC Tower, 32^nd Street, Bonifacio Global City, Taguig City 1632

• MNL03, 14th and 15th Floor, Robinsons Cyberscape Beta, Topaz & Ruby Road, Ortigas Center, Pasig City 1600

• MNL04, 12th and 14th Floor, Robinsons Cyberscape Gamma, Topaz & Ruby Road, Ortigas Center, Pasig City 1600

Concur (Philippines) Inc.

• MNL85, 7^th Floor, Alphaland Southgate Tower, corner Edsa and Chino Roces Avenue, Makati City 1205

SuccessFactors (Philippines), Inc.,

• MNL03, 14^th and 15^th Floor, Cyberscape Beta, Topaz & Ruby Road, Ortigas Center, Pasig City 1600